Essential System Administration, 3rd Edition

Network Security

We’ll now turn our attention beyond the single system and consider security in a network context. As with all types of system security, TCP/IP network security inevitably involves tradeoffs between ease-of-use issues and protection against (usually external) threats. And, as is true all too often with Unix systems, in many cases your options are all or nothing.

Successful network-based attacks result from a variety of problems. These are the most common types:

• Poorly designed services that perform insufficient authentication (or even none at all) or otherwise operate in an inherently insecure way (NFS and X11 are examples of facilities having such weaknesses that have been widely and frequently exploited).

• Software bugs, usually in a network-based facility (for example, sendmail) and sometimes in the Unix kernel, but occasionally, bugs in local facilities can be exploited by crackers via the network.

• Abuses of allowed facilities and mechanisms. For example, a user can create a .rhosts file in her home directory that will very efficiently and thoroughly compromise system security (these files are discussed later in this section).

• Exploiting existing mechanisms of trust by generating forged network packets impersonating trusted systems (known as IP spoofing ).

• User errors of many kinds, ranging from innocent mistakes to deliberately circumventing security mechanisms and policies.

• Problems in the underlying protocol design, usually a failure to anticipate malicious uses. ...